Digipost XML

Toolset helping with some of the cumbersome XML APIs of the JDK.

Digipost XML consists of the following three libraries:

• digipost-xml-fundamentals: offers some ergonomics on top of the standard XML APIs in the JDK. The baseline JDK requirement for this is Java 8, and there are not additional dependencies.

• digipost-xml-bind-jakarta: JAXB facilities, inspired by Spring OXM, and in addition contains a library of some useful adapters and other JAXB-related stuff.

• digipost-xml-bind-javax: This is identical to the above, but for the legacy javax.xml.bind namespace. It is, contrary to popular belief, possible to use these two JAXB variants side-by-side, should you need to, thanks to the almighty jaxb-resolver-com.sun.xml.bind.

Read more:

• Digipost XML
  • How to use
  • Digipost XML Fundamentals
    • Secure XML parsers
    • XML validation with schemas
  • Digipost XML Bind (JAXB)

How to use

Declare the following in your dependencyManagement section

<dependencyManagement>
    <dependency>
        <groupId>no.digipost.xml</groupId>
        <artifactId>digipost-xml-bom</artifactId>
        <version>[latest-version]</version>
        <type>pom</type>
        <scope>import</scope>
    </dependency>
    ...
</dependencyManagement>

And depend on the part(s) you need. E.g:

<dependency>
    <groupId>no.digipost.xml</groupId>
    <artifactId>digipost-xml-fundamentals</artifactId>
</dependency>
<dependency>
    <groupId>no.digipost.xml</groupId>
    <artifactId>digipost-xml-bind-jakarta</artifactId>
</dependency>

Digipost XML Fundamentals

The XML APIs of the JDK is admittedly very low-level, and offer flexible access to the excellent XML facilities in Java. Usually you do not access these APIs directly, but they are used implicitly by libraries or frameworks. Should you need to interact directly with these APIs, this library may offer some ergonomics.

Secure XML parsers

SAX parsers can not be shared across threads, because they modify their internal state per parsing task. So you obtain a parser each from a SAXParserFactory each time you are going to parse som XML. Both initializing the factory and using it to create a parser are pestered with checked exceptions.

SaxParserProvider is just the same factory pattern for obtaining a SAX parser, but without being forced to handle a smörgåsbord of checked exceptions. In addition, a ready-made secure SAX parser provider is offered through SaxParserProvider.createSecuredProvider(), which yields parsers configured to align with OWASP recommendations.

XML validation with schemas

Creating instances of javax.xml.validation.Schema is something you usually do with static resources you already own. Yet, just pointing to some XSDs you have on classpath to parse and create a Schema to use for validating XML you either create or consume, is ridiculously hard.

SchemaHelper.createW3cXmlSchema(Collection<String> schemaResourceNames) takes a collection of classpath resource names (commonly XSD files you bundle with your application), and gives back an instance of Schema.

Digipost XML Bind (JAXB)

TODO